================================================================================ Find-CarepointHostnames.ps1 - README ================================================================================ WHAT IT DOES ------------ Finds the DNS hostnames for a CAREpoint site when the hospital uses a WILDCARD certificate. Normally you can read a site's hostnames straight out of the certificate's Subject Alternative Name list. A wildcard cert defeats that - a SAN of DNS Name = *.lvh.com DNS Name = lvh.com DNS Name = *.lvhn.org DNS Name = lvhn.org covers every possible subdomain and lists none of them. This script works around it by generating plausible site abbreviations from the site's name, testing them against DNS, and keeping whatever resolves to the server's IP address. It looks for these six applications, and reports them in this order: cp3-service cp3-config cp3-op cp3-sip dx-service dx-client It is READ ONLY. It performs DNS lookups and reads the local certificate store. It changes nothing. ================================================================================ QUICK START ================================================================================ Open PowerShell, change to the folder holding the script, and run one line. Elevation is NOT required. cd C:\CAREpoint3 .\Find-CarepointHostnames.ps1 -SiteName "Lehigh Valley Hospital Cedar Crest" -ExpectedIP 10.17.182.147 -OutFile cedar-crest.csv Three things change from site to site. Everything else stays as it is: +---+-------------+---------------------------------+-----------------------+ | # | PARAMETER | WHAT IT IS | EXAMPLE | +---+-------------+---------------------------------+-----------------------+ | 1 | -SiteName | the campus name, in quotes | "Cedar Crest" | | 2 | -ExpectedIP | that site's CAREpoint server IP | 10.17.182.147 | | 3 | -OutFile | where to save the CSV | cedar-crest.csv | +---+-------------+---------------------------------+-----------------------+ If you prefer it split over several lines, the backtick continues the command: .\Find-CarepointHostnames.ps1 ` -SiteName "Cedar Crest" ` -ExpectedIP 10.17.182.147 ` -OutFile cedar-crest.csv ================================================================================ THE THREE THINGS TO CHANGE ================================================================================ 1. -SiteName The hospital campus name, in double quotes. Use the name as people say it. Words like "Lehigh", "Valley", "Hospital", "Medical", "Center", "Health" and "Network" are ignored automatically, so it does not matter whether you include them. "Lehigh Valley Hospital Cedar Crest" -> same result as "Cedar Crest" Examples: -SiteName "Cedar Crest" -SiteName "Dickson City" -SiteName "17th Street Allentown" -SiteName "Hazleton" -SiteName "Muhlenberg" 2. -ExpectedIP The IP address of THAT site's CAREpoint server. This is what makes the result trustworthy. Any hostname resolving to this address belongs to this site; anything else is filtered out. GET THIS RIGHT. Sister servers differ by one digit (.144 / .145 / .147) and a wrong IP gives a wrong answer. You can omit -ExpectedIP entirely IF you are running the script ON the target server - it will auto-detect the IP from the network adapter. 3. -OutFile Where to save the results as a CSV, for site turn-up documentation. Optional but recommended. Name it after the site: -OutFile cedar-crest.csv -OutFile dickson-city.csv -OutFile 17th-street.csv Saved to the current folder unless you give a full path. ================================================================================ HOW TO FIND THE SERVER'S IP ================================================================================ If you are ON the server: Get-NetIPAddress -AddressFamily IPv4 | Where-Object { $_.IPAddress -notlike "127.*" -and $_.IPAddress -notlike "169.254.*" } | Select-Object IPAddress, InterfaceAlias If you know the server's hostname: Resolve-DnsName carappprd103.lvh.com Or just omit -ExpectedIP when running on the server itself. ================================================================================ READING THE OUTPUT ================================================================================ A successful run ends like this: Hostnames for 'Dickson City' on 10.17.182.144 : APPLICATION HOSTNAME CNAME TARGET ----------- --------------------------- ------------------------ cp3-service cp3-service-dickson.lvh.com carappprd100.lvh.com cp3-config cp3-config-dickson.lvh.com carappprd100.lvh.com cp3-op cp3-op-dickson.lvh.com carappprd100.lvh.com cp3-sip cp3-sip-dickson.lvh.com carappprd100.lvh.com dx-service dx-service-dickson.lvh.com carappprd100.lvh.com dx-client dx-client-dickson.lvh.com carappprd100.lvh.com (host) carappprd100.lvh.com All three CP3 web hostnames present. The "(host)" row is the server's own name - the CNAMEs all point at it. WATCH FOR THIS WARNING: MISSING required hostname(s): cp3-op cp3-service, cp3-config and cp3-op must ALL exist. create-site-and-app-pool.ps1 builds the config and OP hostnames by substituting the prefix in CP3_SERVICE_URL, so a missing record leaves IIS with a binding pointing at a name that does not resolve. Get the record created before deploying. ================================================================================ IF IT FINDS NOTHING ================================================================================ Check these in order. 1. WRONG IP The script will say "Names resolved, but none point at " and then group what it did find by the address those names actually use, with a reverse lookup on each. If one of those groups looks like your site, re-run with that address. 2. RECORDS DO NOT EXIST YET If the run finishes in a couple of seconds and finds only the "(host)" entry, the hostnames have not been created. Fast responses mean DNS is answering "no such name" definitively - it is not a visibility problem. Ask the hospital's DNS team to create them. Send something like: Please create six CNAMEs pointing at .: cp3-service-. cp3-config-. cp3-op-. cp3-sip-. dx-service-. dx-client-. The site token must be IDENTICAL across all six. All are covered by the existing wildcard certificate; no new certificate is needed. 3. UNUSUAL ABBREVIATION Add -Aggressive for a much larger set of guesses, or supply your own: -ExtraTokens cc,cedarcrest,lvhcc 4. DNS CANNOT SEE THE ZONE If the run is SLOW (lookups timing out rather than failing fast): Get-DnsClientServerAddress -AddressFamily IPv4 Confirm the server is using the hospital's internal DNS. ================================================================================ OTHER OPTIONS ================================================================================ -ListTokensOnly Show the abbreviations it would try, then stop. No lookups. Useful to sanity-check an unusual site name. -Aggressive Generate a much larger abbreviation set. Roughly triples the run time. Use for awkward multi-word names. -ExtraTokens Add your own abbreviations: -ExtraTokens cc,ccrest -TestNames Test specific full hostnames verbatim: -TestNames carepoint.lvh.com,careapp.lvh.com -ShowCandidates Print every name it is about to test. -ShowFailures Print the ones that do not resolve too. Verbose. -Domains Override the domains. Normally read automatically from the wildcard certificate installed on the server. -Domains lvhn.org,lvh.com -Prefixes Override the application list and its reporting order. -Prefixes cp3-service,cp3-config,cp3-op,cp3-sip,dx-service,dx-client ================================================================================ AFTER YOU FIND THE HOSTNAMES ================================================================================ The script prints the exact command to configure the server. Run it on the CAREpoint server, elevated: [Environment]::SetEnvironmentVariable('CP3_SERVICE_URL','https://cp3-service-.','Machine') Restart-Service -Name codedeployagent The restart matters. The CodeDeploy agent reads its environment when the service starts, so without it the deployment hooks will not see the new variable and the IIS site creation will fail. Note the service is named "codedeployagent" - no hyphen. "codedeploy-agent" is the Linux name and will report "service not installed" on Windows. ================================================================================ KNOWN SITES (keep this updated) ================================================================================ SITE SERVER IP TOKEN STATUS ----------------------- ------------------- -------------- ------- ------ Dickson City carappprd100.lvh.com 10.17.182.144 dickson records exist 17th Street Allentown carappprd101.lvh.com 10.17.182.145 ? no records found Cedar Crest carappprd103.lvh.com 10.17.182.147 ? not yet checked Domains in use at LVHN: lvh.com, lvhn.org ================================================================================ TROUBLESHOOTING THE SCRIPT ITSELF ================================================================================ "cannot be loaded because running scripts is disabled" powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\CAREpoint3\Find-CarepointHostnames.ps1" -SiteName "..." -ExpectedIP ... "...is not digitally signed" / nothing happens The file was downloaded and is blocked: Unblock-File "C:\CAREpoint3\Find-CarepointHostnames.ps1" "The term '\logger.ps1' is not recognized" or similar The script was pasted into the console instead of run as a file. Always run it as a file. Comma-separated values arriving as one string When using powershell.exe -File , arguments like -Domains a,b arrive as a single string. The script handles this, but running from inside PowerShell with .\Find-CarepointHostnames.ps1 avoids it entirely. ================================================================================